漏洞公告

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

Playwright Capture permits access to local files and internal network resources during page capture

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

ldap3_proto has LDAP Filter stack exhaustion

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

Kanidm has non-constant-time comparison of OAuth2 client_secret

Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname → htmx-driven authenticated request forgery

webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

ShellHub has crash-DoS via field injection in filter and sort-by parameters

@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

Netty epoll transport denial of service via RST on half-closed TCP connection

Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks